FIG. 1a shows a generic structure of a conventional mobile phone network such as a GSM-type mobile phone network. The network comprises a plurality of radio masts 102 serving a corresponding plurality of network cells 100. A base station (not shown in FIG. 1a) comprising a plurality of rf transmitters and receivers is colocated with each mast 102 and each base station is connected to one of a plurality of base station controllers 104. In a GSM-type network the base station is referred to as a Base Transceiver Station (BTS). The base stations and masts 102 provide two-way radio communication with mobile stations such as mobile station 116 within the cells 100. This allows two-way transmission of voice and data traffic to and from a mobile station.
The radio link between a base station and a mobile station is primarily managed by a base station and its associated base station controller. Together these handle radio channel set-up, cell-to-cell hand-overs (in the USA referred to hand-offs) and other radio resource control functions. The radio link carries both traffic, such as speech and data traffic, and control information used to dynamically control transmit power, to allocate radio channels to mobile stations and for signalling functions such as paging a mobile station to alert it to an incoming call.
The network has a hierarchical structure in which a plurality of base station controllers 104 is connected to a Mobile services Switching Centre (MSC) 106 for routing calls between cells served by different base station controllers. The MSCs 106 are in turn connected to a gateway MSC (GMSC) 108, which is connected to the standard Public Switched Telephone Network PSTN 114. A home location register (HLR) 110 and Visitor Location Register (VLR) 112 manage call routing and mobile station roaming; other systems not shown in FIG. 1a provide functions such as security and authentication and billing.
The basic structure of FIG. 1a is common to all mobile phone networks whether or not they are based on GSM, but the nomenclature may differ. For example in a 3G network a Base Transceiver Station is referred to as a Node B, and a Base Station Controller is referred to as a Radio Network Controller (RNC).
In FIG. 1a the cells 100 are shown schematically as a set of interlocking, non-overlapping coverage areas but in practice the coverage of neighbouring cells will overlap, particularly at the edges. The coverage may also have gaps where none of the local base stations provide sufficient signal for a mobile to operate adequately. Although in FIG. 1a the cells have been depicted as all being roughly the same size in practice cell size varies from several kilometres diameter down to pico cells, which are mainly indoor cells, with a diameter of less than 100 m. Interference between neighbouring cells is controlled by, among other things, controlling the transmission frequency and power of the base station and by using modelling programmes to carefully site the base station antennas.
It will be appreciated, even from this brief discussion, that network planning and management is complex. Although modelling can be of great assistance inevitably there is a heavy reliance upon practical network testing, particularly at the early stages of network design and implementation. Once a network has been established there is a continuing need for practical mobile phone network testing, both for trouble-shooting complex problems, such as problems which might only appear in 1 in 1000 calls, and for competitive analysis, that is analysing the performance of a competitor's mobile phone network.
At present many mobile phone network operators test their networks by means of so-called drive testing. A mobile phone is loaded with dedicated drive testing software and connected via a serial cable to a portable computer running additional drive testing software. This is used to control the mobile to cause calls to be established in regular patterns to test network. Special instructions may be issued to the phone, for example to prevent hand-over, to find the edge of a cell, or the mobile may be instructed to make repeated calls in an attempt to reproduce a fault. During these test calls the portable computer gathers diagnostic information from the phone using the serial cable and stores this for later analysis. This diagnostic information generally includes air interface messaging sent and received by the phone in normal operation, that is during call set-up, call clear down, hand-over and the like. Typically a GPS receiver is also connected to the portable computer so that this diagnostic information can be indexed by position and subsequently mapped.
FIG. 1b shows an example of the type of map 120 which can be generated using such a drive testing procedure. Geographical information such as road 134 is overlaid with results of individual measurements, such as measurements 136, and a desired and/or measured pattern of network cells, such as cells 122, 124, 126 and 128. Measurements 136 may be colour coded, for example to indicate signal strength. In the map of FIG. 1b region 132 indicates a hole in the network coverage where calls could be dropped. Region 130 indicates an area where overlapping coverage from two different cells operating at the same frequency could cause interference. Examples of drive testing systems are the TEMS (Test Mobile System) investigation system of Ericsson and the E-7478A GPRS drive test system of Agilent Technologies.
U.S. Pat. No. 6,266,514 (and related patent applications WO 00/28755 and WO 00/28756) describes a system for monitoring a cellular network without need for drive testing, by making use of data which can be collected from mobile phone users. Events such as a quality measurement dropping below a predetermined threshold are detected and the location of the mobile station at the time is then used to construct a map, thus automatically mapping areas of poor coverage. The mobile station position is determined by triangulation from at least three base stations. In a variant of the technique a GPS receiver is located in the mobile station and a mobile position report is transmitted to the base station as part of the network signalling (as a conventional IS136 RQL radio quality message), and thus does not interfere with the traffic.
In another system, described in WO 99/12228, a master automatically initiates calls to multiple automatic mobile responders dispersed within the coverage area of a wireless mobile phone network. This provides a real time indication of the network quality. In a preferred embodiment the responders are each equipped a GPS receiver which provides position, and optionally time and velocity information for the mobile responders. The responders are self-sufficient and may be placed in vehicles which are not dedicated to testing, such as postal or public transit vehicles. The matter is connected to a conventional fixed, land telephone line. The responders check network parameters, in particular audio quality (using 23-tone testing), and transmit the results back to the master mobile station 116 to via the mobile phone network and PSTN. The arrangement of this system simplifies testing in that the responders are essentially self-sufficient and automatic, thus facilitating the monitoring of a network performance over an extended area from a single master location.
The above prior art techniques seek to monitor a mobile phone network performance solely by making measurements at one or more mobile stations. Parameters relating to a user's perception of network performance, such as audio quality, the number of dropped calls and the like are measured but the detailed technical information which engineers setting up and optimising a phone network would ideally like to have access to are not available through such tests.
In a typical third generation CDMA mobile phone network there are some 700 parameters which may be adjusted to affect the performance of any given cell, and a further approximately 300 parameters associated with GPRS data transmission. As well as the problems of poor network coverage and interference from adjoining cells mentioned above, network operators also have complex heuristics for frequency planning and radio resource usage, to attempt to maximise traffic and/or revenue. These considerations are further complicated by variations in traffic load with time of day and other factors.
By only measuring at a mobile station the above described prior art techniques are not able to access details of the network functionality and in particular they are not able to determine the response of the network to an individual call.
The mobile station and network function in some respects as a single complex entity, affected by other mobile stations connected to the network and other traffic carried by the network. It is therefore desirable to be able to monitor the interaction of a mobile station with a network and to investigate how the network responds to attempts by the mobile station to drive traffic through the network in the context of other traffic being carried by the network. It is further desirable to be able to monitor such interactions dynamically since traffic on a digital mobile phone network is managed dynamically on a timescale of a few milliseconds.
GSM-type digital mobile phone networks include an Operation and Maintenance Centre (OMC) which collects statistics from network infrastructure elements such as base stations and switches and compiles these into a database. This provides network operators with a high level view of the network performance which can complement the data obtained by drive testing. Thus, for example, the OMC typically includes counters for every dropped call split out by cell, and time. Several companies, for example ADC Telecommunications of Minneapolis, USA provide systems for analysis of this OMC data. However because the OMC data is aggregated into statistics it cannot provide information relating to an individual mobile station. Data of this type such as the number of protocol errors of an individual mobile station, is only available at a lower level within the network.
In addition to OMC data, call trace and cell trace data is also sometimes available. This data essentially comprises a diagnostics log containing messaging, including air-interface messaging, relating to a single call or cell. These logs are produced by the base station controllers of some of vendor's equipment, and can be helpful in tracking down specific problems with a user or a type of handset.
A third source of data relating to the operation of a mobile phone network infrastructure is provided by protocol analysers. A protocol analyser comprises equipment to tap a link or interface between infrastructure elements (either logical or physical. Broadly speaking a protocol analyser simply records all the data flowing on such a link or across such an interface as “trace file”. Such trace files can contain all the messaging between the two elements connected by the link being tapped, for example all the messaging between a base station controller and a switch. Protocol analysers are available from companies such as Tektronics, Agilent and Edixia of Telecom Technologies, France, Europe. One model “Océan” available from Edixia captures data on 300 E1 (2 Mbps) connections and provides this data over an SDH (Synchronous Digital Hierarchy) link, to allow it to be transferred over a high band width optical network to a data store.
Referring now to FIG. 2, this shows a generic structure 200 for a digital mobile phone network, showing the type of prior art tests which can be carried out.
A mobile station 202 is connected to a base station 204, serving the cell in which the mobile station is located, across an air interface Uu 216. The base station 204 is coupled to a base station controller 206 across interface Iub 218. The base station controller 206 is connected to a voice switch 208 via interface Iuc 220, and thence to a voice phone network 210. These elements correspond to the network elements shown in FIG. 1a. Successively higher nodes concentrate the traffic and omit unnecessary operational messaging, and functionality is generally delegated so that, for example hand-overs between base stations coupled to the same BSC are not seen by higher levels.
Mobile cellular communications systems such as GPRS (General Packet Radio Service) and 3G systems add packet data services to the circuit switched voice services. Thus base station controller 206 is also coupled to a packet switch 212 via Iup interface 222, and thence to a packet data network such as the Internet 214.
In FIG. 2 mobile station is shown connected to a laptop computer 224. This in turn is coupled to a GPS receiver 226 to allow user level drive testing, as shown schematically by box 228. Subscriber level protocol tracing 230 can be performed by capturing data from Iub interface 218 and area level protocol tracing can be performed by capturing data from interface Iu 220, interface Iup 222, and/or interfaces (not shown) within voice switch 208 or packet switch 212. At a higher level Call Detail Records (CDRs) and SS7 (Signalling System No. 7, an international standard used for the ISDN backbone) data 234 may also be collected from voice switch 208 or packet switch 212 for analysis. Vendor specific OMC data 236 provides network statistics as described above. Broadly speaking data collected from elements to the right of dashed line 238 is useful for diagnostic purposes whilst data collected from elements to the left of line 238 provides statistical information on how the network is performing but does not generally allow the reasons for a particular level of performance to be discerned.
FIG. 2 is representative of a range of digital mobile phone networks including so-called 2.5G networks such as GSM/GPRS and third generation mobile communications networks as encompassed by the International Mobile Telecommunications IMT-2000 standard (available from the International Telecommunications Union, ITU at www.itu.int and hereby incorporated by reference).
Unlike GSM, third generation technology uses CDMA (Code Division Multiple Access) rather than TDMA (Time Division Multiple Access) and the IMT-2000 standard encompasses three modes of operation, WCDMA (wideband CDMA) Direct Spread FDD (Frequency Division Duplex) in Europe and Japan, CDMA2000 multicarrier FDD for the USA and TD-CDMA (Time Division Duplex CDMA) for China.
Collectively the radio access portion of a 3G network (RNCs and node Bs) is referred to as UTRAN (Universal Terrestrial Radio Access Network) and a network comprising UTRAN access networks is known as a UMTS (Universal Mobile Telecommunications System) network.
The UMTS telecommunications systems are the subject of standards produced by the 3rd Generation Partnership Project (3GPP), including Technical Specifications 23.101, 25.410, 25.420, 25.430 and 25.931, which are hereby incorporated by reference. The GSM standard and aspects of GPRS are defined in ETSI (European Technical Standard Institute) standards GSM 01 to 12, which are hereby incorporated by reference; details of the GPRS radio interface are described in particular in GSM 03.64 and GSM 04.60. Further aspects of the GPRS service are described in 3GPP Technical Specification 23.060 (version 4.1.0), which is also hereby incorporated by reference, and associated quality of service concepts are defined in 3G TS 23.107 (version 3.0.0) again hereby incorporated by reference.
In FIG. 2 the interfaces shown have different names depending upon the precise form of mobile phone network. The names of the interfaces in the different networks are shown in the following table.
Type ofInterfaceNetworkIup 222Iuc 220Iub 218Uu 216GSM/GPRSGbAAbisUmcdma2000IupIucAquaterUuWCDMAIupIucIubUu
Referring now to FIG. 3a, this shows details of the base station controller 206 and packet switch 212 in a GSM (and/or UMTS) network supporting GPRS functionality.
The elements labelled in FIG. 2 as base station controller 206 and base station 204 make up a Base Station System (BSS) comprising a BSC (or RNC) 300 coupled via an Abis interface 308 to base station (or Node B) 204. The BSC (RNC) 300 is also coupled via an A interface 312 to voice switch 208, and via a PCU A disk interface 310 to a packet control unit (PCU) 302. The PCU 302 is in turn connected, via a Gb interface 314 to a Serving GPRS Support Node (SGSN) 304.
A plurality of SGSNs 304 are connected via a Gn interface 316 to a Gateway GPRS Support Node (GGSN) 306, which in turn is connected via a Gi interface 318 to Internet 214. The SGSNs 304 and GGSN 306 are connected together by means of an IP-based packet switched network, and together make up part of what is referred to as packet switch 212 in FIG. 2. The SGNS and GGSN functionalities (and the functionalities of other elements within the network) may reside on a single physical node or on separate physical nodes of the system. In a GPRS network security and access control functions and tracking the location of an individual mobile station are also performed by the SGSNs.
FIG. 3b shows user end equipment 320 for use with the mobile phone networks of FIGS. 2 and 3a. This equipment comprises a mobile station or handset 322, in the context of data services sometimes referred to as a mobile terminal (MT), incorporating a SIM (Subscriber Identity Module) card 324. Handset 322 is coupled to a personal computer 326, sometimes referred to as Terminal Equipment (TE), by means of a serial connection 328.
Once a handset has attached to a GPRS network it is effectively “always on” and user data can be transferred transparently or non transparently between the handset and an external data network. Personal computer 326 communicates with handset 322 using standard AT commands as defined, for example, in 3GPP Technical Specification 27.007, hereby incorporated by reference. Handset 322 may require a terminal adaptor, such as a GSM datacard (not shown) in FIG. 3b. 
User data is transferred transparently between handset 322 and an external IP network such as Internet 214 by means encapsulation and tunnelling. Where a reliable data link is not required, UDP (User Datagram Protocol, as defined in RFC 768) may be used instead of tunnelling. A packet Temporary Mobile Subscriber Identity (Packet TMSI) is allocated to each GPRS-attached handset and a packet domain subscriber identified by an International Mobile Subscriber Identity (IMSI) is allocated a Packet Data Protocol (PDP) address, which is an IP address specifying a GGSN node to access, so that data from a mobile subscriber can be “tunnelled” to the handset's point of attachment to the network. Radio interface resources are shared dynamically between speech and data as a function of service load and operator preference, as described in more detail below. The GPRS specification separates the radio sub-system from the rest of the network to allow the radio access technology to be changed or upgraded.
It will be appreciated that in a network of the general type shown in FIG. 2, as well voice and/or data traffic each interface carries signalling comprising control messages for managing the network. These messages fall into one of three broad categories, call control signalling, mobility management signalling, and radio resource signalling, although the information available from this signalling depends upon the interface concerned. For example at Abis interface 308 and PCU Abis interface 310 information is available relating to the relative allocation of radio resources to voice and data traffic, but such detailed radio resource signalling is not available at higher levels within the network.
Referring now to FIG. 4a, this shows a system 400 for capturing and analysing data from Abis interface 308 using a protocol analyser. The same principles apply to capturing data at other interfaces within the network.
A plurality of E1 (2.048 Mbps) or T1 (1.544 Mbps) connections 402-410 connect base station controller 300 to base station 204, one E1/T1 data feed being allocated to each base station transceiver. Each of these data feeds is coupled to protocol analyser 414, which writes the captured data into a plurality of data files 416a-c at, for example 15 minute, intervals. These data files may be physically located within the protocol analyser 414 or at some separate, remote location. In a subsequent step a data analyser 418 reads the data in data files 416 and analyses the data for diagnostic purposes. In variants of the technique the captured data is made available on a computer network rather than written to files.
Each 2 Mbps E1 data feed comprises 32 time domain multiplexed 64 Kbps PCM channels, each PCM channel comprising two logical traffic channels and two logical control channels, one each way per call. Data from an E1 data feed is captured and streamed into the data file by protocol analyser 414. Data analyser 418 then implements the appropriate protocol stack for the interface from which the data has been captured in order to convert the data to a useful form. Data analyser 418 may be configured to associate traffic data with signalling data for a single voice call so that the progress of the call, cell-to-cell hand-overs and the like can be monitored. At a low level such as Abis interface 308 information such as RF signal level measurement reports are available whereas data collected at a higher level interface such as the Iup or Gb interface 314 omits such detailed operational signalling. Likewise at the Iub/Abis interface data is available for all subscribers attached to base station 204 but at higher level interfaces such as Iup/Gb data for a larger number of subscribers is available.
Actix Limited of London, UK has a commercial product, CallTracker (trade mark) which can be used to analyse data collected by a protocol analyser in this way. The Actix CallTracker works by monitoring Abis messages from multiple transceivers belonging to a number of cells. Each transceiver can handle multiple simultaneous calls. In order to track every call, the CallTracker analyses all the Abis messages for call initiation sequences, that is call set-ups, and remembers the timeslot information assigned to each new call. If a timeslot assigned to a call is to be changed, for example, at a handover, then the CallTracker interprets the contents of the resulting Abis command sequence in the existing timeslot and uses them to link to the new timeslot that matches the signalling information. The CallTracker then tracks the sequence of messages from the old timeslot and the new timeslot to determine whether the handover is successful or not and updates its internal records accordingly. This process repeats until the call terminates, and in this way the CallTracker is able to determine the timeslot information for each call and hence is able to associate each Abis message with a particular call.
By using a GPS receiver coupled to a personal computer a set of timed position measurements for a mobile station can be logged in a data file. The CallTracker software is able to combine this position information with data from the protocol analyser in order to generate a map showing the position dependence of call-related parameters. However there remains a need for still more detailed information, in particular relating to the dynamic behaviour of the network, especially where the transmission of packet switched data is concerned. This can be illustrated by considering the allocation of radio resources in a GSM-based GPRS packet data transmission network.
In a GSM-type network 124 carrier frequencies are used each carrying TDMA (Time Divsion Multiple Access) data. This TDMA data is arranged in burst periods of 156.25 bits each lasting 0.577 ms, eight burst periods constituting a TDMA frame (which lasts approximately 4.6 ms). One physical channel comprises one burst period per TDMA frame, so that each frame carries 8 channels. Some channels are used to carry traffic, such as voice and data traffic, and other channels are used for signalling or control messages, such as the broadcast control channel, the paging channel used to alert the mobile station to an incoming call, and other channels. A group of 26 frames defines a multiframe in which 24 frames are allocated to traffic channels, one frame is allocated to signalling, and one frame is unused.
FIG. 4b shows four TDMA frames 422, 424, 426 and 428 at successive time intervals, each frame comprising 8 timeslots a to h, during each of which data can either be transmitted or received. In FIG. 4b a time slot occupied by data traffic is indicated by “D”, a time slot occupied by speech traffic is indicated by “X”, and an unused time slot is left blank. In GSM-GPRS rules govern which slots may be occupied by data, these rules specifying that for a given upstream/downstream transmit/receive data stream the slots must be contiguous and must not cross the middle point of a frame. Speech data is given priority and when a call initially set up speech may occupy any time slot, although the network may then contrive to shuffle the time slot occupied by a speech connection to create a desired number of data timeslots. Typically a greater data bandwidth is needed for downstream data than for upstream data. In the example shown in FIG. 4b initially in frame 422 three timeslots, 422a-c are occupied by downstream data and one timeslot, 422f is occupied by upstream data. Then, in frame 424, two voice calls occupy timeslots 424a and 424c thus leaving only one downstream timeslot for data, timeslot 424b. In frame 426 the call previously occupying timeslot 424a has been moved to 426h, freeing up two contiguous timeslots for downstream data. Finally in frame 428 the speech channel occupying timeslot 426c has been reallocated to timeslot 428d to once again achieve three contiguous timeslots available for downstream data, timeslots 428a-c. 
It will be appreciated that to properly understand the behaviour of a network it is desirable, for example, to be able to monitor how individual timeslots are being allocated to data channels, in response to both the demands made by an individual mobile station and the load imposed on the network by other traffic in the same or nearby cells. A packet data transmission has an associated quality of service (QoS) profile which is negotiated with the network in accordance with the available GPRS resources. The network always attempts to provide adequate resources to support the negotiated quality of service and the data transmission radio priority is determined based upon this. The quality of service is also classified depending upon whether the traffic is delay sensitive (for example video) or relatively delay insensitive (for example, web browsing). Generally quality requirements such as delay and reliability only apply to incoming traffic up to a guaranteed bit rate.
It will be understood from the foregoing discussion that an important problem arising in the context of 2.5G and 3G mobile phone networks is presented by the need to be able to analyse the dynamic behaviour of the phone network as the network is being exercised. In a circuit switched network, once a circuit has been established it is relatively straightforward to test the characteristics of the channel by making measurements at one end, such as the measurements described above with reference to drive testing. Likewise in a circuit switched network data parameters such as round trip delay are meaningful and useful information regarding data throughput and delay can be obtained simply by making measurements at the mobile station end.
By contrast in a packet switched network different packets may take different routes to their destination, and may be delayed or even lost entirely, depending upon other traffic within the network. Moreover, because the circuit switched voice connections take priority at the radio interface, and because radio channels may be occupied or become free according to whether or when other users in the cell place voice calls, meaningful data about the network performance must take into account not only what is taking place at the mobile station end, but must also take account of what is taking place at other points within the network. In a further complication the priority given to data traffic depends upon the negotiated quality of service and upon the class of traffic being sent or received. There are additional complicating factors imposed by the network operators, such as data rate limitations placed on users trying to send or receive large volumes of data (to stop low rate traffic being denied access) which means that packets are not necessarily allocated slots on a random basis.
There is therefore a need for improved systems and methods for testing and monitoring digital mobile phone networks, and in particular 2.5G and 3G networks configured for the transmission of packet data.